bbassieandClaude Opus 5.5
e6554e09c7
controller.hosts is now a HostManager wrapping the hosts datastore, the same way controller.users wraps the users datastore. It owns creating hosts (moved from HostPairingManager), revoking them (moved from ControlConnection) and signing and verifying host tokens (moved from Controller, generateHostToken is renamed signHostToken to match signUserToken). UserManager gains verifyUserToken, replacing the copies of the user token check in WsServer and routes. The WsServer copy accepted a token without iat when the user had no tokenValidAfter; the shared check always requires iat, which jsonwebtoken adds by default. Follows Cooldude2606's comment on #1161. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Clusterio Player Auth Plugin
Plugin authenticating logged in players to the web interface. Authentication is achieved by a simple challenge response mechanism where players have to log into one of the Factorio server in the cluster and open a dialog that presents a code, this code is input into the login form on the web interface which gives back a second code. Once the player enters the second code into the dialog in-game the web interface is authenticated.
Installation
Run the following commands in the folder Clusterio is installed to:
npm install @clusterio/plugin-player_auth
npx clusteriocontroller plugin add @clusterio/plugin-player_auth
Substitute clusteriocontroller with clusteriohost or clusterioctl if this a dedicate host or ctl installation respectively.
Controller Configuration
player_auth.code_length
Length in character of the generated challenge codes that need to be input between the web interface login form and the in-game Factorio login dialog.
Defaults to 6.
player_auth.code_timeout
Time in seconds the first code generated stays valid. The login must be completed in less than this time starting from when the login dialog is opened in-game.
Defaults to 120.
player_auth.show_connect_address
Show the address to connect to for each server in the server list on the login page of the web interface, made up of host.public_address and the game port of the instance. This list is visible to anyone who can reach the web interface, so leave it off if you don't want unauthenticated users to see where the servers are.
Defaults to false.